Password-based key protection
InfoTeCS2B stroenie 1, ul. Otradnaya Moscow127273Russian Federation+7 (495) 737-61-92Ekaterina.Karelina@infotecs.ru
General
Network Working Group
This document supplements . It contains the specifications of the cryptographic algorithms defined by the Russian national standards
for their implementation of generating general key in the password-based schemes.
This document supplements . It describes the recommendations for using in the information systems with the realisations
of the GOST 28147-89 and GOST R 34.12-2015 encryption algorithms and the GOST R 34.11-2012 hashing functions
in public and corporate networks to protect non-state information.
The use of the GOST 28147-89 encryption algorithm in these mechanisms remains for compatibility with existing implementations.
The methods described in these recommendations are designed to generate key information using the user's password and protect information using the generated keys.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
"RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted
as described in BCP 14 when, and only when,
they appear in all capitals, as shown here.
Throughout this document, the following notations are used:
Pa password in Unicode UTF-8Sa random initializing valueca number of iterations of algorithm, a positive integerdkLena length in bytes of derived key, a positive integerDKa derived key of length dkLenB_n
a set of all byte row vectors of length n, n >= 0;
if n = 0, then the set B_n consists of an empty string of length 0A||Ca concatenation of two byte strings A, C, i.e., a vector from B_(|A|+|C|), where the left subvector from B_(|A|)
is equal to the vector A and the right subvector from B_(|C|) is equal to the vector C\xora bit-wise exclusive-or of two byte strings of the same lengthR^n_r: B_n -> B_ra truncating a byte string to size r by removing the least significant n-r bytes Int(i)a four-byte encoding of the integer i =< 2^32: (i_1, i_2, i_3, i_4) \in B_4, i = i_1 + 2^8 * i_2 + 2^16 * i_3 + 2^24 * i_4b[i, j]a substring extraction operator: extracts bytes i through j, 0 =< i =< j.CEIL(x)the smallest integer greater than, or equal to, x
This document uses the following abbreviations and symbols:HMAC_GOSTR3411Hashed-based Message Authentication Code. A function for calculating a message authentication code,
based on the GOST R 34.11-2012 hash function with 512-bit output in accordance with .
The DK key is calculated as a diversification function PBKDF2(P, S, c, dkLen) using the
HMAC_GOSTR3411 function as the PRF pseudo-random function:
DK = PBKDF2(P,S,c,dkLen).
The diversification function is calculated using the following algorithm:
If dkLen > (2^32 - 1) * 64, output "derived key too long" and stop.
Calculate n = CEIL(dkLen / 64).
Calculate a set of values for each i from 1 to n:
U_1(i) = HMAC_GOSTR3411 (P, S || INT (i))U_2(i) = HMAC_GOSTR3411 (P, U_1(i))...U_c(i) = HMAC_GOSTR3411 (P, U_{c-1}(i))T(i) = U_1(i) \xor U_2(i) \xor ... \xor U_c(i)
Concatenate the byte strings T(i) and extract the first dkLen bytes to
produce a derived key DK:
DK = R^{n * 64}_dkLen(T(1)||T(2)||...||T(n))Data encryption using the DK key is carried out in accordance with the PBES2 scheme (see ,
section 6.2) using GOST 28147-89 in the Cipher Feedback Mode (CFB) (see ).
The encryption process for PBES2 consists of the following steps:
Select the random value S of length from 8 to 32 bytes. The recommended length is 32 bytes.Select the iteration count c depending on the conditions of use.
The minimum allowable value for the parameter is 1000, the recommended value is 2000.Set the value dkLen = 32.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Select the random value S^{'} of length from 8 bytes.Encrypt the message M with GOST 28147-89 algorithm in CFB mode under the derived key DK and the random value S^{'} to produce a ciphertext C.Save the parameters S, S^{'}, c as algorithm parameters in accordance with .
The decryption process for PBES2 consists of the following steps:
Set the value dkLen = 32.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e.,
DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Decrypt the ciphertext C with GOST 28147-89 algorithm in CFB mode under the derived key DK and the random value S^{'} to produce the message M.Data encryption using the DK key is carried out in accordance with the PBES2 scheme (see ,
section 6.2) using GOST R 34.12-2015 in CTR_ACPKM mode (see ).
The encryption process for PBES2 consists of the following steps:
Select the random value S of length from 8 to 32 bytes. The recommended length is 32 bytes.Select the iteration count c depending on the conditions of use.
The minimum allowable value for the parameter is 1000, the recommended value is 2000.Set the value dkLen = 32.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e.,
DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Generate the value ukm of size n, where n takes a value of 12 or 16 bytes, depending on the selected encryption algorithm:
GOST R 34.12-2015 "Kuznyechik" n = 16 (see )GOST R 34.12-2015 "Magma" n = 12 (see )Set the value S^{'} = ukm[1..n-8]For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see )
encrypt the message M with GOST R 34.12-2015 algorithm under the derived key DK and the random value S^{'} to produce a ciphertext C.For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see )
encrypt the message M with GOST R 34.12-2015 algorithm under the derived key DK and the ukm in accordance with the following steps:
- Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm (see ):
encryption key K(1)MAC key K(2).
Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm takes the folowing values:
K_in = DKlabel = "kdf tree"seed = ukm[n-7..n]R = 1 - Compute MAC for the message M using the K(2) key. Append to the end of the message M the computing MAC value. - Encrypt the resulting byte string with MAC with GOST R 34.12-2015 algorithm under the derived key K(1) and the random value S^{'} to produce a ciphertext C.Save the parameters S, c, ukm as algorithm parameters in accordance with .
The decryption process for PBES2 consists of the following steps:
Set the value dkLen = 32.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Set the value S^{'} = ukm[1..n-8], where n is the size of ukm in bytes.For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see )
decrypt the ciphertext C with GOST R 34.12-2015 algorithm under the derived key DK and the random value S^{'} to produce the message M.For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see )
decrypt the ciphertext C with GOST R 34.12-2015 algorithm under the derived key DK and the ukm in accordance with the following steps:
- Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm:
encryption key K(1)MAC key K(2).
Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm takes the folowing values:
K_in = DKlabel = "kdf tree"seed = ukm[n-7..n]R = 1 - Decrypt the ciphertext C with GOST R 34.12-2015 algorithm under the derived key K(1) and the random value S^{'} to produce the text.
The last k bytes of the text are the mac, where k depends on the selected encryption algorithm. - Compute MAC for the text[1..m - k] using the K(2) key, where m is the size of text. - Compare the original mac and the receiving MAC. If the sizes or values do not match, the message is distorted.PBMAC1 scheme is used for message authentication (see .
This scheme bases on the HMAC_GOSTR3411 function with the key DK = PBKDF2 (P, S, c, 32).The MAC generation operation for PBMAC1 consists of the following steps:
Select the random value S of length from 8 to 32 bytes. The recommended length is 32 bytes.Select the iteration count c depending on the conditions of use.
The minimum allowable value for the parameter is 1000, the recommended value is 2000.Set the dkLen at least 32 bytes. It depend on the selected key generation scheme.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Process the message M with the underlying message authentication scheme under the derived key DK to generate a message authentication code T.Save the parameters S, c, ukm as algorithm parameters in accordance with .The MAC verification operation for PBMAC1 consists of the following steps:
Set the dkLen at least 32 bytes. It depend on the selected key generation scheme.Apply the key derivation function to the password P, the salt S and the iteration count c
to produce a derived key DK of length dkLen bytes in accordance with the algorithm from .
Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).Process the message M with the underlying message authentication scheme under the derived key DK to generate a message authentication code T^{'}.Compare the original message authentication code T and the receiving message authentication code T^{'}. If the sizes or values do not match, the message is distorted. The focus of this document is security; hence security considerations permeate this specification.This section defines ASN.1 syntax for the key derivation functions, the encryption schemes, the message authentication scheme, and
supporting techniques ().
rsadsi OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 113549 }
pkcs OBJECT IDENTIFIER ::= { rsadsi 1 }
pkcs-5 OBJECT IDENTIFIER ::= { pkcs 5 }
The object identifier id-PBKDF2 identifies the PBKDF2 key derivation function:
id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12 }
The parameters field associated with this OID in an AlgorithmIdentifier shall have type PBKDF2-params:
PBKDF2-params ::= SEQUENCE
{
salt CHOICE
{
specified OCTET STRING,
otherSource AlgorithmIdentifier {{PBKDF2- SaltSources}}
},
iterationCount INTEGER (1000..MAX),
keyLength INTEGER (32..MAX) OPTIONAL,
prf AlgorithmIdentifier {{PBKDF2-PRFs}}
}
The fields of type PBKDF2-params have the following meanings:
- salt contains the random value S in OCTET STRING.- iterationCount specifies the iteration count c.- keyLength is the length of the derived key in bytes. It is optional field for PBES2 sheme since it is always 32 bytes.
It must be present for PBMAC1 sheme and must be at least 32 bytes since the HMAC_GOSTR3411 function has a variable key size.- prf identifies the pseudorandom function. The identifier value must be id-tc26-hmac-gost-3411-12-512, the parameters value must be NULL:
id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) reg7(7)
tk26(1) algorithms(1) hmac(4) 512(2)
}
The object identifier id-PBES2 identifies the PBES2 encryption scheme:
id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13 }
The parameters field associated with this OID in an AlgorithmIdentifier shall have type PBES2-params:
PBES2-params ::= SEQUENCE
{
keyDerivationFunc AlgorithmIdentifier { { PBES2-KDFs } },
encryptionScheme AlgorithmIdentifier { { PBES2-Encs } }
}
The fields of type PBES2-params have the following meanings:
- keyDerivationFunc identifies the key derivation function in accordance with .- encryptionScheme identifies the encryption scheme in accordance with , .The GOST 28147-89 encryption algorithm identifier should take the following value:
id-Gost28147-89 OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rans(2)
cryptopro(2) gost28147-89(21)
}
The parameters field associated with this OID in an AlgorithmIdentifier shall have type Gost28147-89-Parameters:
Gost28147-89-Parameters ::= SEQUENCE
{
iv Gost28147-89-IV,
encryptionParamSet OBJECT IDENTIFIER
}
Gost28147-89-IV ::= OCTET STRING (SIZE (8))
The fields of type Gost28147-89-Parameters have the following meanings:
- iv contains the random value S^{'} in OCTET STRING.- encryptionParamSet identifies the substitution block for encryption. For PBES2 sheme it is recommended to use the set of substitutions described in .
The OID of this block is:
id-tc26-gost-28147-param-Z OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) constants(2) cipher(5) gost28147(1) paramZ(1)
}
The Gost34.12-2015 encryption algorithm identifier SHOULD take one of the following values:
id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) algorithms(1) cipher(5)
gostr3412-2015-magma(1) mode-ctracpkm(1)
}
In case of use id-gostr3412-2015-magma-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with .
The length of gamma block s is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.
id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) algorithms(1) cipher(5)
gostr3412-2015-magma(1) mode-ctracpkm-omac(2)
}
In case of use id-gostr3412-2015-magma-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with ,
and MAC is computed by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits).
The length of gamma block s is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.
id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) algorithms(1) cipher(5)
gostr3412-2015-kuznyechik(2) mode-ctracpkm(1)
}
In case of use id-gostr3412-2015-kuznyechik-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with .
The length of gamma block s is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.
id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::=
{
iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) algorithms(1) cipher(5)
gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2)
}
In case of use id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with ,
and MAC is computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128 bits).
The length of gamma block s is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.The parameters field in an AlgorithmIdentifier shall have type Gost3412-15-Encryption-Parameters:
Gost3412-15-Encryption-Parameters ::= SEQUENCE
{
ukm OCTET STRING
}
The field of type Gost3412-15-Encryption-Parameters have the following meanings:
- ukm must be present and must contain n bytes. It's value depends on the selected encryption algorithm:
GOST R 34.12-2015 "Kuznyechik" n = 16 (see )GOST R 34.12-2015 "Magma" n = 12 (see )The object identifier id-PBMAC1 identifies the PBMAC1 message authentication scheme:
id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14 }
The parameters field associated with this OID in an AlgorithmIdentifier shall have type PBMAC1-params:
PBMAC1-params ::= SEQUENCE
{
keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } },
messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } }
}
The fields of type PBMAC1-params have the following meanings:
- keyDerivationFunc is identifier and parameters of key diversification function in accordance with - messageAuthScheme is identifier and parameters of HMAC_GOSTR3411 algorithm.These test vectors are formed by analogy with test vectors from .
The input strings below are encoded using ASCII.
The sequence "\0" (without quotation marks) means a literal ASCII NULL
value (1 octet). "DK" refers to the Derived Key.
Input:
P = "password" (8 octets)
S = "salt" (4 octets)
c = 1
dkLen = 64
Output:
DK = 64 77 0a f7 f7 48 c3 b1 c9 ac 83 1d bc fd 85 c2
61 11 b3 0a 8a 65 7d dc 30 56 b8 0c a7 3e 04 0d
28 54 fd 36 81 1f 6d 82 5c c4 ab 66 ec 0a 68 a4
90 a9 e5 cf 51 56 b3 a2 b7 ee cd db f9 a1 6b 47
Input:
P = "password" (8 octets)
S = "salt" (4 octets)
c = 2
dkLen = 64
Output:
DK = 5a 58 5b af df bb 6e 88 30 d6 d6 8a a3 b4 3a c0
0d 2e 4a eb ce 01 c9 b3 1c 2c ae d5 6f 02 36 d4
d3 4b 2b 8f bd 2c 4e 89 d5 4d 46 f5 0e 47 d4 5b
ba c3 01 57 17 43 11 9e 8d 3c 42 ba 66 d3 48 de
Input:
P = "password" (8 octets)
S = "salt" (4 octets)
c = 4096
dkLen = 64
Output:
DK = e5 2d eb 9a 2d 2a af f4 e2 ac 9d 47 a4 1f 34 c2
03 76 59 1c 67 80 7f 04 77 e3 25 49 dc 34 1b c7
86 7c 09 84 1b 6d 58 e2 9d 03 47 c9 96 30 1d 55
df 0d 34 e4 7c f6 8f 4e 3c 2c da f1 d9 ab 86 c3
Input:
P = "password" (8 octets)
S = "salt" (4 octets)
c = 16777216
dkLen = 64
Output:
DK = 49 e4 84 3b ba 76 e3 00 af e2 4c 4d 23 dc 73 92
de f1 2f 2c 0e 24 41 72 36 7c d7 0a 89 82 ac 36
1a db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 0e 36
ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 80 71
Input:
P = "passwordPASSWORDpassword" (24 octets)
S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets)
c = 4096
dkLen = 100
Output:
DK = b2 d8 f1 24 5f c4 d2 92 74 80 20 57 e4 b5 4e 0a
07 53 aa 22 fc 53 76 0b 30 1c f0 08 67 9e 58 fe
4b ee 9a dd ca e9 9b a2 b0 b2 0f 43 1a 9c 5e 50
f3 95 c8 93 87 d0 94 5a ed ec a6 eb 40 15 df c2
bd 24 21 ee 9b b7 11 83 ba 88 2c ee bf ef 25 9f
33 f9 e2 7d c6 17 8c b8 9d c3 74 28 cf 9c c5 2a
2b aa 2d 3a
Input:
P = "pass\0word" (9 octets)
S = "sa\0lt" (5 octets)
c = 4096
dkLen = 64
Output:
DK = 50 df 06 28 85 b6 98 01 a3 c1 02 48 eb 0a 27 ab
6e 52 2f fe b2 0c 99 1c 66 0f 00 14 75 d7 3a 4e
16 7f 78 2c 18 e9 7e 92 97 6d 9c 1d 97 08 31 ea
78 cc b8 79 f6 70 68 cd ac 19 10 74 08 44 e8 30